Password Storage: Salting, Stretching and Peppering

Lesson plan

Level

Beginner

Time

About 60 minutes; the steps below add up to 60

Learners draw conclusions from a site that emails back an old password, and work out how a site could check a password it cannot read, before hashing is named. Predictions then precede offline guessing, making identical passwords differ, deliberate slowness, an extra secret kept apart, SHA-256 for passwords and Password1; checks follow encryption, four thousand identical passwords, salt secrecy and salt against pepper. The habit to build: assume the database will be stolen, and ask what each layer still protects.

Objectives

• Explain why passwords are hashed, not stored in plain text or encrypted
• Explain why a single fast hash fails against offline guessing
• Describe dictionary, brute-force and rainbow-table attacks
• Explain salting, key stretching and peppering
• Name suitable password-hashing schemes, and what good storage does not fix

Before the lesson

• Open this page on your own screen and use “Open the lesson window” to open the lesson in a second window. Share only that second window.
• Learners need the Hashing and Integrity lesson first.
• Avoid demonstrating any cracking tool or website; the lesson is conceptual.
• The lesson takes about 60 minutes. To teach it in two parts, stop after “Key stretching”; the second part opens with “Peppering”.
• In presentation mode every step is shown in turns: Next reveals one moment, part or answer at a time, and the instructor view names what is on screen and what comes next.

Steps

1. Introduction Opening

   On screen: the lesson’s title, module and number; Next adds its objectives and key terms, as the lesson page lists them; Next again begins the first step.

   Objectives on screen

   • Explain why passwords are hashed, not stored in plain text or encrypted
   • Explain why a single fast hash fails against offline guessing
   • Describe dictionary, brute-force and rainbow-table attacks
   • Explain salting, key stretching and peppering
   • Name suitable password-hashing schemes, and what good storage does not fix

   Purpose: Learners draw conclusions from a site that emails back an old password, and work out how a site could check a password it cannot read, before hashing is named. Predictions then precede offline guessing, making identical passwords differ, deliberate slowness, an extra secret kept apart, SHA-256 for passwords and Password1; checks follow encryption, four thousand identical passwords, salt secrecy and salt against pepper. The habit to build: assume the database will be stolen, and ask what each layer still protects.

2. 1. Forgot my password Think 5 min

   Purpose: Raise how passwords are stored from an emailed password.

   Ask

   • What does the email tell you?
   • How can a site check what it cannot read?

   Responses to expect

   • The comparison idea usually needs one hint.
   • On screen in turns: the opening question, its answer; then the question on checking without reversing, and its answer.

   Discussion pause: Ask what else the site could do with passwords it can read.

   In the lesson window

   • Think it through: A website emails you your old password when you click “forgot password”. What does that tell you about how it stores passwords, and why might that worry you?
   • Think it through: If a site stores only a scrambled version of each password that cannot be unscrambled, how can it check your password when you sign in?

3. 2. The problem: storing passwords Explain 5 min

   Purpose: Compare plain text, encryption and hashing.

   Ask

   • Why is encryption weaker than hashing?

   Responses to expect

   • Whoever has the key can reverse it.
   • On screen in turns: the opening; then three ways to keep passwords, starting with plain text; encrypted; hashed; the check question on encrypted passwords, and its answer; hashing is the right idea.

   In the lesson window

   • Check your understanding: Why is encrypting stored passwords weaker than hashing them?

4. 3. Why a fast hash is not enough Predict 6 min

   Purpose: Explain offline guessing, speed and sameness.

   Ask

   • How can hashes be attacked?
   • How many guesses for four thousand accounts?

   Responses to expect

   • “Hashes cannot be reversed, so they are safe” is common.
   • On screen in turns: the opening; then the question on a hash that cannot be reversed, and its answer; guessing, starting with a likely password; hash it; look for it; repeat; an offline attack, and its two problems; sameness; the check question on four thousand users, and its answer.

   Misconceptions to challenge

   • A learner may believe: “A hash cannot be reversed, so hashed passwords are safe.” Respond: Attackers guess and compare.

   In the lesson window

   • Think it through: An attacker steals a database of SHA-256 password hashes. Hashes cannot be reversed. How could the attacker still find passwords?
   • Check your understanding: Four thousand users chose the same password, stored as unsalted hashes. How many correct guesses does the attacker need to open all their accounts?

5. 4. Rainbow tables and password cracking Explain 4 min

   Purpose: Name dictionary, brute-force and rainbow-table attacks.

   Ask

   • What makes a rainbow table useful?

   Responses to expect

   • Unsalted hashes.
   • On screen in turns: the opening; then three attacks, starting with a dictionary; brute force; a precomputed table; the rainbow table; the important word: unsalted.

6. 5. Salting Predict 8 min

   Purpose: Explain salting with Amira and Ben’s identical passwords.

   Ask

   • How could identical passwords differ?
   • Must the salt be secret?

   Responses to expect

   • Most assume the salt is secret.
   • On screen in turns: the opening question, its answer; then the salt; setting and checking with a salt; what a salt achieves, starting with different hashes; useless precomputed tables; one account at a time; one password, two salts, with the stored hashes held back; the stored hashes; how the hashes were computed; without a salt; a salt need not be secret; the check question on a secret salt, and its answer; what salting does not do.

   Misconceptions to challenge

   • A learner may believe: “A salt must be kept secret.” Respond: No: it is kept next to the hash.

   Discussion pause: The stored hashes are held back: ask whether Amira’s and Ben’s hashes will match before revealing them.

   If the explanation does not land: Two pupils with the same sandwich: label each lunchbox with a different random sticker, and the boxes no longer match.

   In the lesson window

   • Think it through: How could you make two users with the same password end up with different stored hashes, without either of them changing their password?
   • Check your understanding: Must a salt be kept secret?

7. 6. Key stretching Predict 5 min

   Purpose: Explain deliberate slowness and memory cost.

   Ask

   • Why make checks slow?

   Responses to expect

   • Users check once; attackers billions of times.
   • On screen in turns: the opening; then the question on slowing down on purpose, and its answer; repeating the work; a difference of scale, starting with the genuine user; the attacker; raising the cost over time.

   In the lesson window

   • Think it through: Why might making each password check deliberately slow be a good idea?

8. 7. Peppering Predict 5 min

   Purpose: Explain the pepper and how it differs from the salt.

   Ask

   • What extra secret helps?
   • Which is secret and shared?

   Responses to expect

   • Salt and pepper are easily swapped.
   • Diagram: reveal the three rows one at a time; for each, ask what an attacker with the stolen database could do.
   • On screen in turns: the opening question, its answer; then the pepper; where the pepper is kept; the one case it covers; three ways to store a password, starting with a single fast hash; salted and stretched; salted, stretched and peppered; the check question on salt or pepper, and its answer; salt and pepper, side by side.

   In the lesson window

   • Think it through: An attacker steals only the password database, not the server’s other stores. What extra secret could make every guess impossible to test?
   • Check your understanding: Which is secret and the same for every password?

9. 8. Modern password-hashing schemes Predict 6 min

   Purpose: Name the suitable schemes and why SHA-256 is not one.

   Ask

   • Is SHA-256 suitable?

   Responses to expect

   • Many think a strong hash is enough.
   • On screen in turns: the opening; then four schemes; the question on SHA-256 for passwords, and its answer; general-purpose hashes are not on the list; NIST’s requirement; setting a password, then signing in, step by step; the diagram’s stages one at a time; changing the cost later.

   Misconceptions to challenge

   • A learner may believe: “SHA-256 is fine for passwords.” Respond: It is built to be fast.

   To go further

   • How can a service move to a stronger scheme without asking everyone to reset their password?

   In the lesson window

   • Think it through: Is SHA-256, used once, a suitable way to store passwords?

10. 9. What good storage does not fix Predict 4 min

    Purpose: Show what storage cannot fix: weak passwords, online attacks, phishing.

    Ask

    • Is Password1 safe?

    Responses to expect

    • No: it falls to early guesses.
    • On screen in turns: the opening question, its answer; then what good storage does not fix, starting with guessable passwords; online attacks; passwords given away; one layer among several.

    In the lesson window

    • Think it through: A site uses the best password-hashing scheme. Is a user whose password is Password1 safe if the database is stolen?

11. 10. Security+ terminology Explain 1 min

    Purpose: Link the lesson to the Security+ wording.

    Ask

    • Which terms are listed?

    Responses to expect

    • Hashing, salting and key stretching.
    • On screen in turns: the opening; then what the objectives do not list.

12. 11. Apply it in a new situation Apply 4 min

    Purpose: Set up independent application, ideally on a later day.

    Ask

    • Who will try these now, and who later in the week?

    Responses to expect

    • The email tests storage; the cost tests stretching; the sign-in page tests online attacks.
    • On screen in turns: the opening; then the question on an old password emailed back, and its answer; the question on raising the cost, and its answer; the question on sign-in guessing, and its answer.

    In the lesson window

    • Apply it: A service emails your old password back to you. What should you conclude?
    • Apply it: Computers have become much faster since a service chose its password-hashing cost. What should it do?
    • Apply it: Attackers type thousands of guesses into a site’s real sign-in page. Which control helps most?

13. 12. Check your understanding Check 5 min

    Purpose: Check the lesson against the approved revision-bank questions.

    Ask

    • Answer individually, then compare before revealing.

    Responses to expect

    • The salt questions link to the worked example.
    • On screen in turns: the opening; then the revision questions one at a time, each followed by its answer; where to practise next.

14. 13. What to remember Consolidate 2 min

    Purpose: Summarise the five points, the key terms and the misunderstandings.

    Ask

    • Without looking: what does a salt defeat?

    Responses to expect

    • Precomputed tables, and cracking many accounts with one guess.
    • On screen in turns: the opening; then the summary; the key terms; the common misunderstandings.

15. Lesson recap Closing

    On screen: the lesson’s objectives again; Next adds the closing question, which asks the class to explain each one in their own words without looking back. It says nothing about what anyone has learnt: use the answers to decide what to revisit.

    Points to listen for

    • Hash, never store or encrypt.
    • Fast hashes help attackers.
    • Unique salts, not secret.
    • Slow every guess; keep a pepper apart.
    • Good storage, weak password: still weak.

Consolidation

• Hash, never store or encrypt.
• Fast hashes help attackers.
• Unique salts, not secret.
• Slow every guess; keep a pepper apart.
• Good storage, weak password: still weak.